Loblaw data breach: what 2 million Canadians should know

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

Loblaw Companies Limited is notifying customers whose personal data was accessed in a cyberattack the company first disclosed in March 2026. Notices began going out by email and mail on October 19, 2026, and Canada's privacy commissioner announced on October 26 that Loblaw has signed a compliance letter committing to further security measures. Loblaw has said about two million Canadians were affected.

What happened

Loblaw confirmed on March 5, 2026 that criminal threat actors had gained unauthorized access to certain of its systems, and announced the breach publicly on March 10 (Confirmed, Office of the Privacy Commissioner of Canada). At the time, Loblaw described the affected data as basic customer information and logged all customers out of their online accounts, including PC Optimum and PC Express (Confirmed, Loblaw). It did not give a number of affected customers in March.

On October 23, the Canadian Press reported that Loblaw now says the breach affected about two million Canadians (Reported). On October 21, Loblaw signed a voluntary compliance letter with the Office of the Privacy Commissioner of Canada (OPC). In it, Loblaw agreed to engage an external security firm to assess its strengthened safeguards and to tell the OPC how it will act on that firm's recommendations (Confirmed, OPC). The letter is not an admission of liability or a finding that Loblaw broke Canadian privacy law, and the OPC investigation stays open until the commissioner is satisfied Loblaw has met its commitments (Confirmed, OPC).

What data was involved

According to the OPC, the information involved varies from person to person and can include (Confirmed, OPC):

• Name, email address, postal address and phone number
• Date of birth
• Loyalty account number
• Purchase order details
• Partial payment card information, such as the last four digits
• Billing and shipping addresses

Loblaw has said passwords, health information and full credit card data were not compromised (Confirmed, Loblaw, March 2026). Not every customer had every data type exposed, so your notice is the best guide to what applies to you.

What affected people can do now

1. Check your notice the safe way. Scammers often send fake breach notices after an incident like this. If you get an email about the Loblaw breach, do not click its links. Go to Loblaw's website or your PC Optimum account directly, or call the number printed on a mailed letter.
2. Enrol in the credit monitoring offer. Loblaw is offering affected customers 24 months of credit monitoring and identity restoration through TransUnion (Reported, Canadian Press). Use the enrolment code and deadline in your own notice.
3. Expect convincing phishing. Because names, contact details and purchase details may be involved, a scam message could quote a real order or the last four digits of your card. Treat unexpected messages about refunds, deliveries or account problems with caution, and never share a full card number or one-time code.
4. Watch your payment statements. Partial card numbers alone cannot be used to make purchases, but review statements for charges you do not recognize and report them to your card issuer.
5. Consider a fraud alert. Your date of birth, address and name together are useful for identity fraud. You can ask Equifax Canada and TransUnion Canada to place a fraud alert on your credit file.
6. Look at where your address and birth date already appear. Name, home address, phone number and date of birth are the same fields people-search sites publish. Searching your name and removing listings you find reduces how easily someone can match this breach data to other public profiles.